[CVE-2026-57301] Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rathe…

Descripción técnica

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

Puntuación CVSS

Score: 8.8/10 — Severidad: HIGH — Estado NIST: Analyzed

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Productos afectados

Official owasp zap — Jenkins

Debilidades (CWE)

CWE-610

Fuente oficial

Publicado en NIST NVD.